The Sixth Circuit Court of Appeals has ruled once again: the government can't …

Share this story

The government must obtain a valid search warrant before infiltrating your e-mail in a criminal investigation, the Sixth Circuit Court of Appeals has ruled. The appeals court ruled Tuesday on US v. Warshak, noting that e-mail "requires strong protection under the Fourth Amendment," and that law enforcement can't demand for an ISP to give up e-mail with just a court order.

The story behind the case goes back to 2006, when the Feds gained access to e-mail belonging to Steven Warshak, the man behind the "natural male enhancement" product Enzyte. At the time, Warshak had already incurred the wrath of the FTC, which said that there was no evidence that his products worked and found that his company routinely signed up callers for a monthly subscription plan that was difficult to cancel. Soon the FBI and the Postal Inspectors got on Warshak's case for mail and wire fraud as well.

The government was able to gain access to Warshak's e-mail thanks to a court order—a move that requires a significantly lower burden of proof than a full-on warrant. Warshak pushed back on the grounds that the search violated his Fourth Amendment rights. The Sixth Circuit Court of Appeals eventually ruled in Warshak's civil case that his e-mail was indeed Constitutionally protected and that the ability to get the court order without notification was no longer allowed.

Although that previous ruling from the appeals court still stands, the latest decision is related to Warshak's criminal case (he was convicted in 2008 on 93 counts of conspiracy, fraud, and money laundering, and received a 25-year prison sentence). The Sixth Circuit once again agreed that a warrant is necessary before the government can access a citizen's e-mails through an ISP.

"Given the fundamental similarities between e-mail and traditional forms of communication, it would defy common sense to afford e-mails lesser Fourth Amendment protection," wrote the court.

"It follows that e-mail requires strong protection under the Fourth Amendment; otherwise the Fourth Amendment would prove an ineffective guardian of private communication, an essential purpose it has long been recognized to serve," wrote the court. "[T]he ISP is the functional equivalent of a post office or a telephone company. As we have discussed above, the police may not storm the post office and intercept a letter, and they are likewise forbidden from using the phone system to make a clandestine recording of a telephone call—unless they get a warrant, that is."

"Today's decision is the only federal appellate decision currently on the books that squarely rules on this critically important privacy issue..." the EFF said in a statement. "We hope that this ruling will spur Congress to update that law as EFF and its partners in the Digital Due Process coalition have urged, so that when the government secretly demands someone's email without probable cause, the email provider can confidently say: 'Come back with a warrant.'"

As for Warshak, the court upheld his criminal conviction but threw out his 25-year sentence, with a remand for resentencing.

Share this story

Jacqui Cheng
Jacqui is an Editor at Large at Ars Technica, where she has spent the last eight years writing about Apple culture, gadgets, social networking, privacy, and more. Emailjacqui@arstechnica.com//Twitter@eJacqui

29 Reader Comments

That doesn't mean they won't continue to do it anyway; not all ISPs will refuse the requests without warrants. It all depends on the accused having a decent lawyer and the money to defend against the charges. If you're poor you're still going to get screwed.

Well, yeah, I imagine it'll be just like telephone companies. FBI (or NSA or Homeland Security or whoever it was) went to the telcos and said they wanted to tap people's phones for suspected terrorism, and few of them asked to see a warrant. No reason to believe ISPs will be any different at all.

Being poor fortunately doesn't mean that you are not savvy. If you:a) hold on all and every paper that you getb) request and explore all legal recourse that you havec) go to the EFF with a strong enough case,then the EFF will probably have a pleasure paying for your legal fees if that would warrant a legal precedent for heavy fines against ISPs that do not follow due procedure and hand over private coms without a warrant.

Telcos don't do that anymore, after being bitten by a few high-profile cases, and I bet it's the only thing required to make ISPs follow.

I don't understand, isn't the police subject to the courts? If a court rules, a warrant automaticly follows?

No. It's a matter of how far out a court is willing to stick its neck. A court order is fairly easy to issue but isn't supposed to allow violation of privacy. A search warrant grants legal power to violate privacy but can only be issued if the police can give a definition of what they expect to find. Discoveries that don't pertain to the search warrant may not be admissible as evidence.

No, a court order and a warrant are two wildly different legal beasts, and have different process requirements. The warrant requires reasonable cause (a.k.a. some legally acceptable partial proof that something illegal has been committed), the court order only requires the "will of the court".

I don't understand, isn't the police subject to the courts? If a court rules, a warrant automaticly follows?

Search warrants are based on probable cause and require a judge to sign off on them. The fact that the government doesnt like to even get a search warrant shows hows corrupt we have let these agents get. Search warrants are notoriously easy to get. Many judges dont really challenge the probable cause or affidavits police provide. Im just glad one appellate court stood up to these completely unconstitutional actions by police.

Now sue the living crap out of ISP, telcos, and anyone else giving away personal info to police without search warrants and these corporations will protect privacy stuff better. Hitting the wallet is the only way to keep these hoodlums in line.

That doesn't mean they won't continue to do it anyway; not all ISPs will refuse the requests without warrants. It all depends on the accused having a decent lawyer and the money to defend against the charges. If you're poor you're still going to get screwed.

Thanks to this ruling evidence obtained in the way you describe isn't usable by a prosecutor. Cops might not get the warrant, but they certainly should if they want to obtain a conviction.

Silly question, but does ISP also include other hosted email like Gmail or Hot Mail?

Reading the decision, ISP is not used. They simply note that obtaining the email requires a warrant. So, to answer your question, it looks like this decision does cover Gmail.

Okay, so: another silly question. As worded, it seems to me the decision has to do with *stored* email. Am I correct that email *in transit* is NOT protected? (I.e., there is no protection against "mail-tapping"?) (Could be a thin line, I suppose...catch it before it gets stored.)

Read e-mail vs track/sort the ip/to/from headers? Thats the very old trick that is used. A massive passive database of who is connected to who. One person gets a real court sneak and peek letter, anyone one connected gets their email lists sorted - who they are connecting to and so on.

Or a voice print of interest is detected over a city that was recored years ago and all the people getting direct calls and their numbers called are logged.They dont listen to every call, but they collect all the numbers and wait.

So if they dont listen/read they can collect all connecting details they want.

Silly question, but does ISP also include other hosted email like Gmail or Hot Mail?

Reading the decision, ISP is not used. They simply note that obtaining the email requires a warrant. So, to answer your question, it looks like this decision does cover Gmail.

Okay, so: another silly question. As worded, it seems to me the decision has to do with *stored* email. Am I correct that email *in transit* is NOT protected? (I.e., there is no protection against "mail-tapping"?) (Could be a thin line, I suppose...catch it before it gets stored.)

IANAL, and I did not read it all, but I believe that by this ruling, email is considered protected regardless of location or method of interception. So I believe "email-tapping" without a warrant would be just as unacceptable as "wire-tapping" or "mail-intercepting/reading" without a warrant.

The judge, in his opinion, stated that an email is analogous to a letter, and noted that the police cannot intercept and inspect a letter in transit without a warrant. He also referred to wire-tapping. It seemed to me, he carefully crafted arguments that the email should be treated as protected. And did not leave room for any obvious loopholes, like "email-tapping".

It therefore seems to me, that even though an unencrypted email is basically the equivalent of a post card to any of the servers handling it (unless it is encrypted of course, then is more like a letter in a security envelope), the police are still not allowed to intercept the email without a warrant, any more than they are allowed to wire tap a phone call.

The ruling indicates that the officers gathering the evidence really should have needed a warrant, but had made a "good faith" effort to gather the data legally, so the evidence was allowed. But, in the future, the court would not allow evidence gathered in such a manner (without a warrant) to be used.

But as AHuxley mentioned, I believe they can still legally track who is corresponding to whom, as long as they don't actually inspect the email contents without a warrant.

Well, yeah, I imagine it'll be just like telephone companies. FBI (or NSA or Homeland Security or whoever it was) went to the telcos and said they wanted to tap people's phones for suspected terrorism, and few of them asked to see a warrant. No reason to believe ISPs will be any different at all.

Nah...I don't think the telcos are any more interested in "providing taps" for the government than ISP customers are interested in having their emails read illegally. It costs money to gather this kind of evidence, and an ISP would be a fool to just blindly accede to some detective's request for a customer's email--any ISP doing that without the compulsion of a warrant is a real dunderhead. Indeed, as of this ruling, being accused of stupidity might be the least of the troubles an ISP would face for releasing this information without a warrant.

Now sue the living crap out of ISP, telcos, and anyone else giving away personal info to police without search warrants and these corporations will protect privacy stuff better. Hitting the wallet is the only way to keep these hoodlums in line.

I don't think you will have to. Companies are pretty lazy when it comes to this sort of thing. They take the path of least resistance. If it seems legal for a court to issue a court order for e-mail, they will just do it. The alternative is a legal battle with the state. Now the rules have flipped. It is clearly illegal to hand out e-mails without a court order. Companies being lazy are just going to shrug and ask for the warrant. The new rules are much easier for ISPs. Before, they had to violate trust with customers and waste manpower gathering e-mails on flimsy grounds and get nothing in return. Now, they get to respond to respond to court orders with a form letter and wait for a warrant before they start riffling through your spam mail. It is easier and cheaper for ISP, good for privacy, and great for rule of law. It is a win for everyone.

"We hope that this ruling will spur Congress to update that law as EFF and its partners in the Digital Due Process coalition have urged, so that when the government secretly demands someone's email without probable cause, the email provider can confidently say: 'Come back with a warrant.'"

Be careful what you ask for. When Congress updates a law it is usually more than you bargained for. Pray they (Darth Congress) don't change it further.

Wow, you mean the courts actually leaned toward constitutional rights? I hope it continues. Kinda sucks but I feel like they will do the wiretap anyways and then argue through lengthy court battles that they were actually 'in the right'

Well, yeah, I imagine it'll be just like telephone companies. FBI (or NSA or Homeland Security or whoever it was) went to the telcos and said they wanted to tap people's phones for suspected terrorism, and few of them asked to see a warrant. No reason to believe ISPs will be any different at all.

Nah...I don't think the telcos are any more interested in "providing taps" for the government than ISP customers are interested in having their emails read illegally. It costs money to gather this kind of evidence, and an ISP would be a fool to just blindly accede to some detective's request for a customer's email--any ISP doing that without the compulsion of a warrant is a real dunderhead. Indeed, as of this ruling, being accused of stupidity might be the least of the troubles an ISP would face for releasing this information without a warrant.

Please read the above. The telcos get bid-less jobs if they cooperate, and most of the abuse is not by the police but by the NSA, and it costs quite a bit less to just hand over all of your data than to carefully select a certain piece of data and triple verify it for a criminal prosecution.

So far almost all of the major telcos have been more than friendly towards the government, and the government has been friendly right back. This allows them to perpetuate monopolies. Monopolies are fine for utilities like ISPs and telephones, but only if they are regulated to prevent abuse. They haven't been adequately policed, and surprise, telcos spend some of the most on bribery *ahem* "political donations" to both parties. http://arstechnica.com/tech-policy/news ... dy-att.ars

Then don't use a "telco" for your email if you're that paranoid. Google has shown in the past that they can be uncooperative with the government and governments in general. According to the EFF in their statement about this case: "the government must have a search warrant before it can secretly seize and search emails stored by email service providers". That means what it means. All you armchair lawyers tin-foil hat wearers that posted above cynically suggest that ISP's and telcos will just give the government whatever they want anyway, should re-read the decision.

Google and other email services want to instill confidence in their users..which are their customers...which is where they get the lion-share of their money. Do you really think they want the bad-press from now on if they were to just hand over anything the government wants without a warrant when they can easily and legally just say "you need a warrant"? Step away from the cynical hysteria for a moment and put on your critical thinking cap.

Seriously, here's all I see in this thread:

"The courts ruled that law enforcement needs a warrant to search your emails".

"Oh yeah? Well....they'll just continue to do it anyway. It's a conspiracy! They're all out to get you!"

What's really pathetic here is it sounds like they would have _easily_ been able to get a warrant. There was plenty of proof of criminal activity and they knew what they expected to find. So they were too lazy to do it right (right = being damn sure it'll hold up in court) and now the guy may get a lesser sentence than he deserves because of that.

What's really pathetic here is it sounds like they would have _easily_ been able to get a warrant. There was plenty of proof of criminal activity and they knew what they expected to find. So they were too lazy to do it right (right = being damn sure it'll hold up in court) and now the guy may get a lesser sentence than he deserves because of that.

What this guy said is very true. This is all about lazy police work - getting a search warrant, WHEN YOU HAVE CAUSE, is not hard. If you don't have cause, then - duh - you can't get a warrant. It's a pretty simple mechanism to protect us from over zealous officials. It is hardly an onerous standard for the cops to meet.

OK, 1) any judge who can issue a "court order" can equally issue a warrant, in fact, it's LESS paperwork to issue a warrant.

2) The "burden of proof" to issue a warrant is probable cause. A warrant simply has to follow due process. The only real difference between a court order and a warrant is that a warrant is served by authorities, and a court order can mandate just about anyone to perform the action of collection of the specified items. There's an "oath of affirmation" involved in acquiring a warrant, ad a court order doesn't technically require that, however, court orders typically come later in a process after a person has already been charged and the case is IN COURT. Anything collected with a court order in place of a warrant may or may not be admissible, and that is determined later IN court, where anything captured with a warrant is essentially ruled admissible by pre-review. That is one major difference.

3) This ruling means they can't ask an ISP to hand over your email without a warrant, but a court order CAN still be issued to order YOU to turn over your own email, no differently than they can order you to do such for personal records. You "could" refuse, but you would be in contempt of court, then they'll issue a warrant to get it anyway. A court order is simply a bench order, documented, telling you to do something so the court and city don't have to make the expense themselves (and waste the time) to get get it personally.

4) this in no way prevents the government from snooping in-flight messages, so long as they only access the headers (previously rules by the supreme court to be no different than the OUTSIDE of a postal letter, which is in public hands until final delevery). Unencrypted messages in flight can also still be accessed through due process without a warrant through a bench order, or probable cause in some cases, but it still requires a documented PROCESS. They can't (and never could) simply access all e-mail in flight, they have to access messages exclusive to activity in open cases or persons of interest, and they still don;t need warrants for that.

This only effected court orders to 3rd parties, its a minor ruling, and an expected one. It doesn't prevent the govenment or other authorities from getting this beyond making them use a single sheet of multi-part form that are so rare for a judge to refuse they make national news when warrants are declined to be issues.

"The courts ruled that law enforcement needs a warrant to search your emails".

"Oh yeah? Well....they'll just continue to do it anyway. It's a conspiracy! They're all out to get you!"

It's a sign of the times Goofball.

The average person (well, the average person who follows these types of stories anyway) has seen our rights, particularly as they pertain to digital information, be steadily eroded over the last decade or so, oftentimes by people conducting spirited end-runs around existing blocks in the system. It's not a conspiracy so much as it's just people working a well-defined system to get the results they want most expediently, and not caring too damn much if some innocents are violated along the way. Places us right in the middle of a slippery slope.

While I'm happy to see some sanity return to interpretations of Fourth Amendment protections to digital communications, I'm also of the opinion that, under the circumstances, cynicism is certainly warranted.